API Keys

Server URLloading...

GET

/v1/settings/api-keys

Send

Authorization

Returns the active (non-revoked) API keys stored for the calling workspace, newest first. Expired keys are still listed until revoked (compare ak_expires_at with the current time). The secret is never returned, only its first 12 characters (ak_prefix).

Keys are stored under the workspace they were created from. Manage keys with a production key (or from the dashboard): a dev scoped key only sees keys created from the development workspace.

Response Body

curl -X GET "https://example.com/v1/settings/api-keys"

{  "keys": [    {      "ak_id": 42,      "ak_name": "Staging backend",      "ak_prefix": "sq_d_Xk3v9Qa",      "ak_scope": "dev",      "ak_created_by": 17,      "ak_created_by_name": "Alice Martin",      "ak_created_at": "2026-09-01 09:12:44",      "ak_last_used_at": "2026-09-25 07:58:10",      "ak_expires_at": "2026-12-01 09:12:44",      "ak_is_active": true    }  ]}

Server URLloading...

POST

/v1/settings/api-keys

Send

Authorization

Body

Generates a new API key. The full key is returned only once in the response and cannot be retrieved later.

• scope binds the key to a workspace: prod (production data) or dev (the isolated development workspace). Keys look like sq_p_<40 chars> (prod) or sq_d_<40 chars> (dev).
• name: 3-100 characters of letters, digits, spaces and < > / : . , _ -.
• expires_in_days: optional positive integer. The key stops authenticating (401) after that many days. Omitted, zero, negative or non-integer values mean the key never expires.
• At most 10 active keys per workspace (expired but unrevoked keys count).

Keys are created from a signed-in session only: called with an API key, this answers 403 (a key cannot mint keys). A key created while the session is on the development workspace is stored in and bound to that workspace whatever its scope.

A key carries the role of the member who creates it: an admin's key can call admin-only operations for as long as that member stays an admin.

Response Body

curl -X POST "https://example.com/v1/settings/api-keys" \  -H "Content-Type: application/json" \  -d '{    "name": "Staging backend",    "scope": "dev",    "expires_in_days": 90  }'

{  "status": "ok",  "key": "sq_d_Xk3v9Qa7Lm2Pz8Rt4Wy6Bn1Cd5Fg0Hj3Kl9Mn7Q"}

Server URLloading...

DELETE

/v1/settings/api-keys

Send

Authorization

Query

Revokes an API key of the calling workspace (soft delete: ak_is_active becomes false and the key disappears from the list). Authentication results are cached for up to 5 minutes, so a revoked key can keep working for that long on other instances.

Requires a signed-in session (403 with an API key). A member can revoke the keys they created; revoking another member's key needs an admin (403 otherwise). For an admin, an ak_id that does not exist or belongs to another workspace still returns {"status": "ok"} and changes nothing.

Query Parameters

Response Body

curl -X DELETE "https://example.com/v1/settings/api-keys?ak_id=0"

{  "status": "ok"}